5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13281

CVE-2025-13281: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13281

CVE-2025-13281:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	< 1.32.10	1.32.10
k8s.io/kubernetes	go	>= 1.33.0-alpha.0, < 1.33.6	1.33.6
k8s.io/kubernetes	go	>= 1.34.0-alpha.0, < 1.34.2	1.34.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a half-blind Server-Side Request Forgery (SSRF) in the kube-controller-manager's in-tree Portworx volume driver. An authenticated user can create a StorageClass that points to a malicious endpoint for the Portworx API. When operations like provisioning, attaching, detaching, or deleting volumes are performed, the kube-controller-manager makes requests to this malicious endpoint.

Prior to the patch, the raw error messages from these backend API calls were returned to the user. If the malicious endpoint is an internal service, the error messages could contain sensitive information from that service's response, thus leaking data.

The identified vulnerable functions (portworx.portworxVolumeMounter.SetUpAt, portworx.portworxVolumeUnmounter.TearDownAt, portworx.portworxVolumeDeleter.Delete, and portworx.portworxVolumeProvisioner.Provision) are the entry points for these volume operations. The patches for these functions replace the returning of raw errors with logging the detailed error to the kube-controller-manager.log and returning a generic error message to the user. This change prevents the information leak, confirming that these functions were the ones processing the malicious input and producing the vulnerable output.

Vulnerable functions

portworx.portworxVolumeMounter.SetUpAt

pkg/volume/portworx/portworx.go

The function calls `b.manager.AttachVolume` and, prior to the patch, returned the raw error. This could leak information if a malicious Portworx endpoint is configured, causing an SSRF.

portworx.portworxVolumeUnmounter.TearDownAt

pkg/volume/portworx/portworx.go

This function calls `c.manager.UnmountVolume` and `c.manager.DetachVolume`. Before the patch, it returned raw errors from these calls, which could leak information from a crafted Portworx endpoint in an SSRF attack.

portworx.portworxVolumeDeleter.Delete

pkg/volume/portworx/portworx.go

The `Delete` function, prior to the patch, returned the raw error from `d.manager.DeleteVolume`. This exposed potentially sensitive information from the backend in the event of an error, which is the basis of the SSRF vulnerability.

portworx.portworxVolumeProvisioner.Provision

pkg/volume/portworx/portworx.go

This function calls `c.manager.CreateVolume` and previously returned the raw error. An attacker could leverage this by specifying a malicious Portworx API endpoint in the StorageClass, causing the error to leak information from the targeted service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.